The transfer of personal data out
of the European Union is subject to a detailed regulatory regime in Regulation
2016/679 (“the GDPR”), and may be permitted on a number of different
bases. The most straightforward basis is where the European Commission has made
a finding of adequacy under Article 45. In the absence of such a finding,
transfers may be made on the basis of appropriate safeguards, including
standard data protection clauses drafted by the Commission and adopted as a
binding contract between the data exporter (in the EU) and the data importer
(in the third country): Article 46(3)(c).
In Case C-311/18 Data Protection Commissioner v
Facebook Ireland Ltd & Schrems (judgment of 16 July 2020), the
CJEU considered the validity under the GDPR and the Charter of the standard
data protection clauses and the Privacy Shield adequacy decision adopted in
respect of the United States of America.
The CJEU struck down the Privacy
Shield decision, holding that US law failed to limit the potential access to
transferred data of its national security agencies through their surveillance
programmes to what was strictly necessary and proportionate. Data subjects
were not provided sufficient rights to take action against the US Government in
US courts, and the Ombudsperson mechanism created for the Privacy Shield was
insufficiently independent and unable to adopt binding decisions. The CJEU
refused to stay the effect of its decision. Transfers of personal data to the
USA on the basis of the Privacy Shield decision are, accordingly, unlawful
under the GDPR.
However, the CJEU upheld the
validity of the standard clauses and gave a detailed defence of their
contractual mechanisms to protect the rights of data subjects, through the
obligations placed on both the exporter and importer of the data. Transfers on
the basis of standard clauses remain valid, and the CJEU accepted that the
generic nature of the clauses could not be invalidated by reference
to concerns about the laws of one particular third State. However, the
CJEU emphasised the responsibility of data exporters to confirm for themselves
that use of the standard clauses would in fact provide an adequate level of
protection for data subjects in the context in which they were used, and
emphasised the obligation on supervisory authorities to suspend or prohibit
transfers under such clauses to third States for which the clauses would not
provide an adequate level of protection.
The Schrems II decision of the CJEU is a major
data protection judgment, and has huge practical importance to all controllers
engaged in any form of international transfers of personal data. It will also
have significant implications for the data protection regime applicable in and
to the United Kingdom following the end of the implementation period.
The judgment can be read here.
Christopher Knight acted for the
UK Government, led by Josh Holmes KC for the written observations and unled at
the hearing.
